admin/ayoubfaouzi-al-khaser
1
0
Fork 0
mirror of https://github.com/ayoubfaouzi/al-khaser synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #113 from PolariumLabs/XPSupport

Browse Source 
XP Support
This commit is contained in:
Noteworthy
2018-06-21 18:14:16 +02:00
committed by GitHub
parent bbf020b39b e31d023496
commit a2aa0dc0d0
5 changed files with 36 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
al-khaser/Anti VM/Qemu.cpp
+2 -1
View File
@@ -87,7 +87,7 @@ BOOL qemu_firmware_ACPI()
PDWORD tableNames = static_cast<PDWORD>(malloc(4096));
SecureZeroMemory(tableNames, 4096);
DWORD tableSize = EnumSystemFirmwareTables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableSize = enum_system_firmware_tables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableCount = tableSize / 4;
if (tableSize < 4 || tableCount == 0)
result = TRUE;
@@ -112,6 +112,7 @@ BOOL qemu_firmware_ACPI()
}
}
lblCleanup:
free(tableNames);
return result;
}
al-khaser/Anti VM/VMWare.cpp
+2 -1
View File
@@ -237,7 +237,7 @@ BOOL vmware_firmware_ACPI()
PDWORD tableNames = static_cast<PDWORD>(malloc(4096));
SecureZeroMemory(tableNames, 4096);
DWORD tableSize = EnumSystemFirmwareTables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableSize = enum_system_firmware_tables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableCount = tableSize / 4;
if (tableSize < 4 || tableCount == 0)
result = TRUE;
@@ -259,6 +259,7 @@ BOOL vmware_firmware_ACPI()
}
}
lblCleanup:
free(tableNames);
return result;
}
al-khaser/Anti VM/VirtualBox.cpp
+2 -1
View File
@@ -451,7 +451,7 @@ BOOL vbox_firmware_ACPI()
PDWORD tableNames = static_cast<PDWORD>(malloc(4096));
SecureZeroMemory(tableNames, 4096);
DWORD tableSize = EnumSystemFirmwareTables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableSize = enum_system_firmware_tables(static_cast<DWORD>('ACPI'), tableNames, 4096);
DWORD tableCount = tableSize / 4;
if (tableSize < 4 || tableCount == 0)
result = TRUE;
@@ -480,6 +480,7 @@ BOOL vbox_firmware_ACPI()
}
}
lblCleanup:
free(tableNames);
return result;
}
al-khaser/Shared/Utils.cpp
+29 -2
View File
@@ -792,12 +792,39 @@ BOOL find_str_in_data(PBYTE needle, size_t needleLen, PBYTE haystack, size_t hay
}
UINT enum_system_firmware_tables(DWORD FirmwareTableProviderSignature, PVOID pFirmwareTableBuffer, DWORD BufferSize)
{
typedef UINT(WINAPI* tEnumSystemFirmwareTables)(DWORD, PVOID, DWORD);
tEnumSystemFirmwareTables f_EnumSystemFirmwareTables = (tEnumSystemFirmwareTables)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "EnumSystemFirmwareTables");
if (NULL == f_EnumSystemFirmwareTables)
{
printf("Couldn't find EnumSystemFirmwareTables :(\n");
// If the function fails for any other reason, the return value is zero.
// https://msdn.microsoft.com/en-us/library/windows/desktop/ms724259(v=vs.85).aspx
return 0;
}
return f_EnumSystemFirmwareTables(FirmwareTableProviderSignature, pFirmwareTableBuffer, BufferSize);
}
PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD pBufferSize)
{
DWORD bufferSize = 4096;
PBYTE firmwareTable = static_cast<PBYTE>(malloc(bufferSize));
SecureZeroMemory(firmwareTable, bufferSize);
DWORD resultBufferSize = GetSystemFirmwareTable(signature, table, firmwareTable, bufferSize);
typedef UINT(WINAPI* tGetSystemFirmwareTable)(DWORD, DWORD, PVOID, DWORD);
tGetSystemFirmwareTable f_GetSystemFirmwareTable = (tGetSystemFirmwareTable)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetSystemFirmwareTable");
if (NULL == f_GetSystemFirmwareTable)
{
printf("Couldn't find GetSystemFirmwareTable :(\n");
free(firmwareTable);
return NULL;
}
DWORD resultBufferSize = f_GetSystemFirmwareTable(signature, table, firmwareTable, bufferSize);
if (resultBufferSize == 0)
{
printf("First call failed :(\n");
@@ -810,7 +837,7 @@ PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD p
{
firmwareTable = static_cast<BYTE*>(realloc(firmwareTable, resultBufferSize));
SecureZeroMemory(firmwareTable, resultBufferSize);
if (GetSystemFirmwareTable(signature, table, firmwareTable, resultBufferSize) == 0)
if (f_GetSystemFirmwareTable(signature, table, firmwareTable, resultBufferSize) == 0)
{
printf("Second call failed :(\n");
free(firmwareTable);
al-khaser/Shared/Utils.h
+1
View File
@@ -37,6 +37,7 @@ ULONG get_gdt_base();
UCHAR* get_str_base();
BOOL IsElevated();
BOOL find_str_in_data(PBYTE needle, size_t needleLen, PBYTE haystack, size_t haystackLen);
UINT enum_system_firmware_tables(_In_ DWORD FirmwareTableProviderSignature, _Out_ PVOID pFirmwareTableBuffer, _In_ DWORD BufferSize);
PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD pBufferSize);
#define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, x)